Skip to content

Latest commit

 

History

History
60 lines (40 loc) · 1.77 KB

firewall.rst

File metadata and controls

60 lines (40 loc) · 1.77 KB
Raw

Firewall

NethServer 8 comes with a simple built-in firewall.

  • The cluster VPN network interface wg0 is part of a trusted zone where all traffic is permitted.
  • All other network interfaces are part of a public zone where only specific ports are open.

By default, an NS8 node has the following open ports:

  • Wireguard VPN, 55820 UDP
  • HTTP and HTTPS, 80 and 443 TCP
  • SSH, 22 TCP
  • Cockpit (not installed by default), 9090 TCP

Applications that require publicly open ports, such as the Mail server, will automatically configure the firewall.

Review firewall settings

Under the Settings page, click on the :guilabel:`Firewall` card and select a node of the cluster.

  • For the selected node, a table summarizes the services running on the node and their open TCP and UDP ports. If a port is not listed here, it is closed for connections from the public zone.
  • Below the table of services and open ports, there is a list of the network interfaces of the node.

The same page is accessible from the Nodes page by selecting the Firewall action from the three-dots menu of each node card.

Manage ports manually

To allow connections to the listening port of a third-party service, use firewall-cmd. For instance, the following command opens TCP port 9000:

firewall-cmd --add-port=9000/tcp

To close the same port, use:

firewall-cmd --remove-port=9000/tcp

Changes to the firewall configuration are lost after a firewall restart or system reboot unless the same command is invoked a second time with the --permanent flag. Refer to the firewall-cmd manual page for more information.

To see the list of allowed services and ports, run:

firewall-cmd --list-all